Vulnerabilities > CVE-2017-8850 - Cleartext Transmission of Sensitive Information vulnerability in Oneplus Oxygenos

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE

Summary

An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).

Vulnerable Configurations

Part Description Count
OS
Oneplus
1
Hardware
Oneplus
5

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Session Sidejacking
    Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim. This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Harvesting Usernames or UserIDs via Application API Event Monitoring
    An attacker hosts an event within an application framework and then monitors the data exchanged during the course of the event for the purpose of harvesting any important data leaked during the transactions. One example could be harvesting lists of usernames or userIDs for the purpose of sending spam messages to those users. One example of this type of attack involves the attacker creating an event within the sub-application. Assume the attacker hosts a "virtual sale" of rare items. As other users enter the event, the attacker records via MITM proxy the user_ids and usernames of everyone who attends. The attacker would then be able to spam those users within the application using an automated script.
  • Signature Spoofing by Mixing Signed and Unsigned Content
    An attacker exploits the underlying complexity of a data structure that allows for both signed and unsigned content, to cause unsigned data to be processed as though it were signed data.
  • Passively Sniff and Capture Application Code Bound for Authorized Client
    Attackers can capture application code bound for the client and can use it, as-is or through reverse-engineering, to glean sensitive information or exploit the trust relationship between the client and server. Such code may belong to a dynamic update to the client, a patch being applied to a client component or any such interaction where the client is authorized to communicate with the server.

Seebug

  • bulletinFamilyexploit
    description#### Summary The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850 & CVE-2017-8851. #### Technical Details OxygenOS & HydrogenOS send the following JSON request to `http://otac.h2os.com/post/Query_Update` or to `http://i.ota.coloros.com/post/Query_Update` in order to check if a new OTA is available: ``` { "beta": "0", "imei": "<IMEI>", "isOnePlus": "1", "language": "en", "mobile": "ONEPLUS A3010", "mode": "0", "ota_version": "<CURRENT_VERSION>", "type": "1", "version": "1" } ``` For example, on a OnePlus 3T device running OxygenOS 4.1.1 this results in the following response, announcing that a 4.1.3 OTA is available: ``` { "active_url": "http://otafsc1.h2os.com/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "description": "https://otafsc.h2os.com/html/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011_version_EN_1492072442240.html", "down_url": "http://otafsc.h2os.com/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "extract": "#OS Version: OnePlus3TOxygen_28_170411\n##WHAT'S NEW\n\\\n\u2022 Upgraded Android 7.1.1 \n\\\n\u2022 Added expanded screenshots \n\\\n\u2022 Improved picture taking of moving objects\n with blur reduction \n\\\n\u2022 Improved video stability when recording\n\\\n\u2022 Improved WiFI connectivity \u00a0\n\\\n\u2022 Improved bluetooth connectivity \n\\\n\u2022 Fixed Instagram swiping bug\n\\\n\u2022 Fixed hardware buttons\u00a0malfunction\u00a0bug\n\\\n\u2022 Increased system stability\n\\\n\u2022 General bug fixes\n [www.oneplus.net](http://www.oneplus.net/)", "new_version": "OnePlus3TOxygen_28.A.51_GLO_051_1704112011", "patchFilePath": "/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "patch_md5": "031507863135b7008c2651ea461d0e9e", "patch_name": "OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "patch_size": "1461187808", "recommend": "100", "share": "\u8bf7\u7528\u82f1\u8bed\u8bbe\u7f6e\u5206\u4eab\u5185\u5bb9", "type": "1", "version_name": "OnePlus3TOxygen_28_1704112011", "wipe": "0" } ``` Man-in-the-Middle attackers can therefore spoof this response in order to exploit CVE-2017-5948, CVE-2017-8850 & CVE-2017-8851. ### POC `https://github.com/alephsecurity/research/tree/master/OnePlusOTA` #### Timeline * 11-May-17: Public disclosure. * 10-May-17: Deadline Extension. * 08-May-17: CVE-2016-10370 assigned. * 08-May-17: CVE ID requested. * 08-May-17: Added as ALEPH-2017022. * 26-Apr-17: Deadline. * 09-Apr-17: 14-day Deadline Extension Offered (no reply). * 26-Jan-17: Reported.
    idSSV:93109
    last seen2017-11-19
    modified2017-05-12
    published2017-05-12
    reporterRoot
    titleOnePlus OTA Lack of TLS Vulnerability(CVE-2016-10370)
  • bulletinFamilyexploit
    description#### Products * OnePlus 3T * OnePlus 3 * OnePlus 2 * OnePlus X * OnePlus One #### Vulnerable Version * All OnePlus OxygenOS & HydrogenOS OTAs #### Technical Details Due to lenient updater-script in the OnePlus OTA images (see below), and the fact both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use adb sideload to push the OTA (on OnePlus 3/3T ‘Secure Start-up’ must be off). updater-script of the OnePlus 3T OxygenOS 4.1.3 OTA: ``` getprop("ro.display.series") == "OnePlus 3T" || abort("E3004: This package is for \"OnePlus 3T\" devices; this is a \"" + getprop("ro.display.series") + "\"."); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") || abort("E1001: Failed to update system image."); show_progress(0.050000, 10); [...] ``` updater-script of the OnePlus 3T HydrogenOS 3.0.0 OTA: ``` getprop("ro.display.series") == "OnePlus 3T" || abort("E3004: This package is for \"OnePlus 3T\" devices; this is a \"" + getprop("ro.display.series") + "\"."); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") || abort("E1001: Failed to update system image."); show_progress(0.050000, 10); [...] ``` #### PoC ``` https://github.com/alephsecurity/research/tree/master/OnePlusOTA ``` #### Timeline * 11-May-17: Public disclosure. * 10-May-17: Deadline Extension. * 08-May-17: CVE-2017-8850 assigned. * 08-May-17: CVE ID requested. * 08-May-17: Added as ALEPH-2017020. * 26-Apr-17: Deadline. * 09-Apr-17: 14-day Deadline Extension Offered (no reply). * 26-Jan-17: Reported.
    idSSV:93107
    last seen2017-11-19
    modified2017-05-12
    published2017-05-12
    reporterRoot
    titleOnePlus OTA OxygenOS/HydrogenOS Crossover Vulnerability(CVE-2017-8850)

The Hacker News

idTHN:51F38064616715ED3D71C32EC64BFB0F
last seen2018-01-27
modified2017-05-12
published2017-05-11
reporterSwati Khandelwal
sourcehttps://thehackernews.com/2017/05/oneplus-mobile-vulnerabilities.html
titleAll OnePlus Devices Vulnerable to Remote Attacks Due to 4 Unpatched Flaws